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Drafted By: I I :aob 



Synopsis: To open case in captioned matter and to advise Cyber 

of a new 288A investigation. 

Details: On 8/14/2008, writer received information from the 
Southern District of New York (SDNY) that the website for a major 
New York City lawfirm, Sullivan & Cromwell, LLP, was spoofed in a 
suspected E-Mail phish. The spoofed website was registered and 
hosted at GoDaddy.com. The Sullivan & Cromwell (S&C) Wikipedia 
page was altered so the link to the legitimate S&C website 
redirected to the spoofed address. Two other major New York City 
lawfirms, Wachtell, Lipton, Rosen & Katz and Greenberg Traurig, 
LLC, have also been victims. All three lawfirms have major 
mergers and acquisitions practices involving deals worth large 
sums of money. S&C believes that someone was trying to intercept 
the misdirected E-Mails, about the mergers and acquisitions, in 
an attempt to get insider information on Wall Street activity. 

The activity occurred in late July, 2008 and the spoofed sites 
were removed, by GoDaddy.com, around 08/08/2008. 
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Department of Highway Safety & Motor Vehicles 

Driver And Vehicle Information Database (DAVID) 
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Tue 7/1/2008 3:23 PM 

2 KB 


kJ 


RE: www.wlrklaw.com 

Tue 7/1/2008 3:20 PM 

3 KB 


L ) 


RE: www.wlrklaw.com 

Tue 7/1/2008 2:56 PM 

5 KB 


U 3 


RE: www.wlrklaw.com 

Tue 7/1/2008 2:43 PM 

509 KB 


*J 


RE: www.wlrklaw.com 

Tue 7/1/2008 2:37 PM 

5 KB 


LJ 


RE: www.wlrklaw.com 

Tue 7/1/2008 1:41 PM 

842 KB 


LJ 


RE: www.wlrklaw.com 

Tue 7/1/2008 12:32 PM 

5 KB 


LJ 


RE: www.wlrklaw.com 

Tue 7/1/2008 12:27 PM 

4 KB 


k£l $ 


RE: www.wlrklaw.com 

Tue 7/1/2008 11:39 AM 

2 MB 


L4i 


RE: www.wlrklaw.com 

Tue 7/1/2008 11:37 AM 

4 KB 


lJ 


FW: JotForm Abuse 

Tue 7/1/2008 11:11 AM 

5 KB 


LJ( 


www.wlrklaw.com 

Tue 7/1/2008 10:56 AM 

3 KB 


slJ 


RE: other 2f vendor 

Tue 7/1/2008 10:19 AM 

8 KB 



I 1 2 9/9/2008 9:17 AM b6 

b7C 








! *& D 0 From 



Subject Received V Size C..,'?' 

RE: other 2f vendor Tue 7/1/2008 10:16 AM 8 KB b6 

RE: other 2f vendor Tue 7/1/2008 10:06 AM 5 KB b7 ' 

RE: Michael from HostLyon.com (718) 591-2859 - c... Mon 6/30/2008 5:33 PM 4 KB 

domain name telephone call - please call me X1551 Mon 6/30/2008 5:16 PM 4 KB 

Fw: Michael from HostLyon.com (718) 591-2859 -... Mon 6/30/2008 5:08 PM 3 KB 



9/9/2008 9:17 AM b6 
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From: I I 

Sent: Monday, June 30, 2008 5:08 PM 

To: I I , 

Subject: Fw: l I from HostLyon.com 


□ you may want to look into the details.. 
Thanks 


Fromj _ I b6 

To-I I_. b7c 

Cc: | I 

Sent: M on Jun 30 17:01:54 2008 

Subject f~ I from HostLvon.com l I 

trying to register the domain name WLRKLAW.COM 

IP address is from Florida - 

this is the information that they provided to set it up on his web posting 


Name: 


Contact inforation: 


234 
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From: 

Sent: 

To: 

Subject: 


Monday, June 30, 2008 5:16 PM 

domain name telephone call - please call me XI551 


FW: | ~| from HostLyon.comj] 


This person called because he has a web-posting advertisement. 


trying to register the domain name WLRKLAW.COM 
IP address is from Florida - 

this is the information that they provided to set it up on his web posting 


Name: 
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Contact Information: 
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From: interlogysupport@gmail.com on behalf of Interlogy Support [support@interlogy.com] 
Sent: Tuesday, July 01,2008 11:07 AM 

To: | 

Subject: Re: JotForm Abuse 
Thanks Q 

•CZI 


for letting 


us know. Account has been terminated. 


On Tue, Jul 1,200 8 at 10 :56 AM, d [ wrote: 

Good Morning Mr j I I represent Wachtell, Lipton, Rosen & Katz, a law firm based in NYC. One of your 
customers is using your jotform service to phish information from another fraudulent site (www.wlrklaw.comV 
We are working with that ISP to shutdown the site, but I ask that you please disable the following form 
immediately. 

http://www.jotform.com/form/81805522147 

Thank you for your assistance. Please contact me once this has been completed. 

Sincerely, 


Wachtell, Lipton, Rosen & Katz 

51 West 52nd Street • New York, NY 10019 _ 

VFBortone@WLRK.com • www.wlrk.com • vCard 

please consider the environment before printing this email 


b6 
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9/9/2008 












Recruiting - Apply For Attorney Position - Windows Jnternet Explorer 


H i http://www.wIrklaw.com/Page/rhreadiRecruit/SubTiiread/Apply%20For%20Attomey%20Position jv 


File Edit View Favorites Tools Help 
Google [GH jv| Go <> Bookmarks^ ^ Check ▼ \, 

Links r A Customize Links ife] DFM Dsview $gj EVDA •~n IBM BladeCenter jjS. KVS Enterprise Vault - Advanced Search 22, KVS Vaul 


Sol”] Parascale Cloud Storage PI... Jp Corporate Emergency Acce... ^Recruiting-ApplyFor... X 


Wachtell, Upton, Rosen & Katz 

THE FIRM ♦ PRACTICE * ATTORNEYS * RECRUITING * ABOUT THIS SIT 


INTRODUCTION 


ASSOC IATES 


CO M PE N SAT! O N 


SUMMER 


PRO GRAM 


APPLY FOR 
ATTO R N EY 


POSITION 



l! =6TOr /! 


This Form Has Been Disabled. 


From: 

Sent: 

To: 

Cc: 

Subject: 


dav. July 1)1, 2008 11:37 AM 


RE: www.wlrkiaw.com 

















b6 

blC 


From: I I 

Sent: Tuesday, July 01.2008 1:41 PM 

To: 

Cc: |_ 

Subject: RE: www.wlrklaw.com 


Update: 


We've stopped their web site search page. Vin has added some software logic to our external 
home page which checks to see if you are being referred to our site from some second party. If 
so we will produce the following screen below <$t not perform the search. 


0 Error Page - Windows Internet Explorer 


'O' 


Hj httpj//www.wIrk.com/ErrorWL,htm 




Live Search 



? 

_____ 

ii^'Page ▼ 10} Tools ▼V 


Links >y <^5naglt [^J 1 


& 4i 


& Error Page 


, V A 


You have received this message because you we're 
referred to our site from www.wlrklaw.com. This 
site is not affiliated with Wachtell, Lipton, Rosen & 
Katz. Please go to www.wlrk.com to browse our 
web site. 


\ 


v. 


S 

3 

V 


/ 


/ 


At this point we've stopped the phishing and referring, but what I cant stop is anyone sending 
to the following address's listed below. 

Questions regarding non-legal personnel can be directed to: hr@wlrklaw.com . 

Questions regarding legal recruiting can be directed to: recruiting@wlrklaw.com . 

To report technical problems or errors on our website, please contact techsupp@wlrklaw. com . 

For press and other information inquiries, please send an email to_ 
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From: |_| 

Sent: .Tuesday, July Q1, 2QQ8 2:43 PM 

To: 

Cc: 

Subject: t\l. www.vviiMdw.uuin - 


No. We are specif ically looking for wlrklaw. All other links should continue to work. I will try <& 
track down that blog you mentioned below to validate. 


— —> 



Ccfif FindNoCase ("wlrklaw", CGI. HTTP_REFERER,. 1) HEQ 0> 

<C FLO CATION url= rr ErrorUL.htm ,f > 

<CFAB0RT> 

</cfif> 

<cfset variables, root = £ ListFirst(CGI.PATNJENFO, "/") & r 7"> 

<cfset variables.fileRoot = Left(CGI.CF_TEHPLATE_PATH, FindNoCase (Replace(root,"/", "V r , "ALL"), CGI. 
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From: 

Sent: 

To: 

Cc: 

Subject: 


i i 

Tnpcriav lnlv 01 7nnR7-T7PM 


RE: www.wlrklaw.com 


Thanks. Do you mean literally that any reference (link) to our site from another part of the 
web will send this message? That seems too much, as many such links will be legit. (E.g. to one 
of our bios — Vin, reminder -- from a blog where we've posted or an article that's been posted 
somewhere, etc.) 


From: I I 

Sent: Tuesday, July 01, 2008 1:41 PM 

To: “ ““ 

Cc: _ 

Subject: RE: www.wlrklaw.com 

Update: 


b6 
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From: 

Sent: 

To: 

Subject: 

Attachments: 


Tuesday, July 01,2008 3:08 PM 
'GoDaddy.com Copyright Claims Dept.' 

Copyright Claim 

| - Chief Information Officer - Business Card with Signature.pdf 


Thank you for your quick response. As requested, I am enumerating the 6 items required by 
your policy. 


1. I amQ 


for Wachtell, Lipton, Rosen, & Katz, 


and am an authorized to act on behalf of Wachtell, Lipton, Rosen & Katz (hereinafter 
"Wachtell"). I am attaching an electronic signature to this e-mail. 


2. The copyrighted work of www.wlrk.com and all subsidiary WebPages thereto is being 
infringed. 


3. All of the material at www.wlrklaw.com is being infringed and includes all subsidiary 
WebPages thereto with the exception of the internal e-mail addresses of wlrklaw.com. In that 
instance, there is a substantial likelihood of confusion as to the ultimate recipient of such 
e-mails. 


4. My contact information is: [ 


Rosen & Katz, 51 West 52nd Street, New York, NY 10019. 
I I My e-mail address is I 


Wachtell, Lipton, 


My direct dial number is 


] 


5. Wachtell believes in good faith based on review of the www.wlrklaw.com that the material 
is not authorized by us, and is being used without permission. 


6. The information contained herein is accurate, and under penalty of perjury, I am 
authorized to act on behalf of Wachtell and its website, www.wlrk.com. 


Thank you for your prompt attention to this matter. 


-Original Message- 

From: GoDaddy.com Copyright Claims Dept. [mailto:CopyrightClaims@GoDaddy.com] 
Sent: Tuesday, Duly 01, 2008 1:55 PM 

To: I —1 

Subject: RE: Copyright Claim 


Dear 


Thank you for contacting GoDaddy.com. It is our policy to actively assist with decreasing 
intellectual property infringement on the Internet. We work regularly with both the courts 
and law enforcement to ensure that this abuse is curtailed. Unfortunately, your submitted 
complaint has been deemed incomplete. 

In compliance with the DMCA (Digital Millennium Copyright Act), we have created a Copyright 
and Trademark dispute policy to help get this matter resolved. You can review Go Daddy's 
Trademark and Copyright Policy found at the following URL: 
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4 


v » H 

http://www.godaddy.com/gdshop/legal_agreements/show_doc.asp?se=%2B&pageid=TRADMARK%5FCOPY 

We can not compile a complete notification (as defined by Section B, Items i-vi) through a 
series of emails. Please include all six required items in a single email. Once you submit a 
complete notification to this department, we will take the necessary action as outlined in 
both our stated policy and the DMCA. 

If you have any further questions, please contact us at this email address. 

Regards, 


Copyright Department 
GoDaddy.com 

CopyrightClaims(a)GoDaddy. com 


> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 


. Original Message - 

Subject: Copyright Claim 
From: <EPStein@wlrk.com> 

Date: Tue, Duly 01, 2008 9:26 am 
To: < copy right claims(a)godaddy. com> 


Please be advised that: 


I am the Chief Information Officer for Wachtell, Lipton, Rosen & Katz, 
a 

law firm based in New York City, NY. Wachtell, Lipton, Rosen & Katz 
(hereinafter, "Wachtell") has as its domain, wlrk.com. 


In the last several days, a new domain registered by an unknown party 

with your company, wlrklaw.com became active and has copied the 
entirety 

of the wlrk.com website with a couple of changes. The changes 
redirect 

e-mail addresses and contact information to the unknown registrant. 


Wachtell has not given permission or otherwise permitted any other 
person to utilize the content of our website, and that such use by 
wlrklaw.com is unauthorized. 


2 






* 

> 

> 

> You may compare our website www.wlrk.com with the infringing website 

> 

> www.wlrklaw.com. 

> 

> 

> 

> This information is accurate as of the writing of this e-mail, and 

> under 

> 

> penalty of perjury, I represent Wachtell, and that we have the 

> exclusive 

> 

> rights to the material being copied. 

> 

> 

> 

> I am requesting that you immediately shut down the infringing website, 

> 

> and that you contact me so we can coordinate further steps. 

> 

> 

> 

> I await your response, 

> 

> 

> _ 

> 

> 

> 

> 

> 

>1 _ 

> 51 West 52nd Street 

> 

> New York, NY 10019 

> _ 

> _ 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> Any tax advice contained in this communication is not intended or 

> written to be used, and cannot be used, for the purpose of avoiding 

> tax penalties and is not intended to be used or referred to in 

> promoting, marketing or recommending a partnership or other entity. 
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V’itlvestment plan on arrangement. 

^ ^ y|* ^ ^ ^ ^ ^ jJj jJj ^ <|* i|> k|* »|* «|* *|* v|* »|* »|» 4^« 4^* «|^ ^ ^ ^ ^ ^ ^ ^ sj/ ^ <|> 4^ 4^ * 4^ v|> 4j« t^( »^j ^ ^ ^ ^ 

> Please be advised that this transmittal may be a confidential 

> attorney-client communication or may otherwise be privileged or 

> confidential. If you are not the intended recipient, please do not 

> read, copy or re-transmit this communication. If you have received 

> this communication in error, please notify us by e-mail 

> (helpdesk@wlrk.com) or by telephone (call us collect at 

> 212-403-4357) and delete this message and any attachments. Thank you 

> in advance for your cooperation and assistance, www.wlrk.com 

^ 'f* H 1 * ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ 'f' ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ •}» ^jc ^jc ?[c *|c »jc 
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From: I ~l 

Sent: Thursday, July 03. 2008 8:05 PM 

To: I I 

Subject: Re: Positions 


http://www.wlrklaw.netyErrorWL.htm 
Cute. To bad it doesn't work! 

p.s. I have disclosed a complaint to the NAF and the DCMA department at Network Solutions in regards to 
your domain (wlrk.com) ! Apparently you stole all wlrklaw.com' s site's content? 

Oh, and I have your IP address, so don't try anything smart, pal. 

Your a fag: 

http://www.lawcrossing.com/images/articIeimages/eugenestein larse.ipg 
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Wachtell, Lipton, Rosen & Katz 

51 West 52nd Street 

New York, New York 10019 

^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ jj# vj* ^ ^ v|j ^ ^ ^ ^ ^ 

Any tax advice contained in this communication is not intended or written to be used, and cannot be used, for 
the purpose of avoiding tax penalties and is not intended to be used or referred to in promoting, marketing or 
recommending a partnership or other entity, investment plan or arrangement. 

Please be advised that this transmittal may be a confidential attorney-client communication or may otherwise be 
privileged or confidential. If you are not the intended recipient, please do not read, copy or re-transmit this 
communication. If you have received this communication in error, please notify us by e-mail 
(helpdesk@wlrklaw.com) and delete this message and any attachments. Thank you in advance for your 
cooperation and assistance. 


l 
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From: 

Sent: 

To: 

Subject: 

Attachments: 


I I 

Thursday, July 03,2008 2:37 PM 
'd m ca @ networksolutions .com' 

Follow-up contact information WLRK 

~|~ Business Card with Signature.pdf 


Thank you again for contacting us. 


I am ttv 

is our official and sole presence. Our administrator is 


]at Wachtell, Lipton, Rosen & Katz (hereinafter “Wachtell"). Our domain, www.wlrk.com 


I am authorized to act on behalf of and for Wachtell. 


I am attaching a pdf of my business card and signature. 


We have become aware that on June 27, 2008, an unknown individual had registered www.wlrklaw.com . That individual 
copied our entire website and purported to represent Wachtell through the "fake” or "spoofed" site. That individual has 
also created e-mail accounts that mimic all of the individuals at Wachtell, but with the domain wlrklaw.com. These are all 
fake. 

Anyone purporting to represent Wachtell with a contact location of wlrklaw.com is not authorized and is engaged in a 
fraud. 


Please feel free to contact me further at my contact information below. 
Thank you. 


WACHTELL, LIPTON, ROSEN & KATZ 
51 West 52nd Street 
New York, N ew York 10019-6150 
Direct Dial: | I 
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From: jotformsupport@gmail.com on behalf of JotForm Support Ootform@jotform.com] 

Sent: Thursday, July 03, 2 008 4:44 AM 


Subject: Re: JotForm 


Hi Vincent, 

The account is deleted now. 


Thank you for reporting. 

H-1 

On Tue, Jul 1, 2008 at 5:08 PM, 


############################### 


> 

> # Name: 

> # Email 

> #######fr 


####################### 


wrote: 


> 

> One of your customers is using your service to frauduantly phish information. He or she 
is using http://www.jotform.com/form/81805522147 at http://www.wlrklaw.com. Please 
disable this form while we work with the ISP to disable the www.wlrklaw.com website. 

Please contact me at 1-212-403-1896 or at vfbortone@wlrk.com when this has been completed. 


> 

> Sincerely, 

> 

> 

> 
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From: disputes_email@tdnam.com 

Sent: Wednesday, Ju ly 09, 2008 2:26 PM 

To: I I 

Subject: Update [Incident ID: 4259931] - Looking to purchase WLRKLAW.COM domain 


Information Regarding Your Support Request 


Oi/ h«* ntcofttod to you mquKt. dtuifc of aw dateiSM Utow 


Discussion Notes 
Support Staff Response 
. Dear Sir/Madam, 

Thank you for contacting TDNAM support. 


Thank you for your interest in WLRKLAW.COM . This name is currently on 
hold awaiting resolution with a previous registrant. The name may be 
available, depending on the outcome, approximately 180 days from the 
original dispute date of7/8/2008 - which would be January 4, 2009. Please 
contact support@tdnam. com on this date if you still have interest in this name 
at that time. 


Please let us know if we can assist you in any other way. 
Sincerely, 


TDNAM.COM / GODADDY.COM 


Customer Inquiry 

I'd like to inquire about purchasing the WLRKLAW.COM domain for my 
company. Can someone please contact me. 


b6 

b7C 


122 









Page 1 of 1 


From: 

Sent: Thursday, July 17, 2008 9:15 PM 

To: 


c 


(Sullivan & Cromwell LLP). 


Subject: Client Referral 


b6 
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I have a corporate client that came to me seeking help with a merger, unfortunately our firm cannot take 
any more merger clients as our teams are too busy. I thought you would be the right person to refer him 
to. 

Please contact me for more details at your earliest convenience, 
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Wachtell, Lipton, Rosen & Katz 

51 West 52nd Street 

New York, New York 10019 

Any tax advice contained in this communication is not intended or written to be used, and cannot be 
used, for the purpose of avoiding tax penalties and is not intended to be used or referred to in promoting, 
marketing or recommending a partnership or other entity, investment plan or arrangement. 

Please be advised that this transmittal may be a confidential attorney-client communication or may 
otherwise be privileged or confidential. If you are not the intended recipient, please do not read, copy or 
re-transmit this communication. If you have received this communication in error, please notify us by e- 
mail fhelpdesk@wlrklaw.com) and delete this message and any attachments. Thank you in advance for 
your cooperation and assistance. 


9/9/2008 
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From: I I 

Sent: Thursday .lulu 17 POOR 4:14 PI 

To: |_ 

Subject: FW: WLRKLAW.COM 

Follow Up Flag: Follow up 

Flag Status: Flagged 

Categories: Red Category 


I didn't think we'd be seeing this guy again, I'm not sure what our next step should be. 


From: | ~| b6 

Sent: Thursday, July 17, 2008 2:16 PM b7c 

To: All ISS Programming 
Subject: Fwd: WLRKLAW.COM 

This is not my problem, this is GoDaddy's problem. Contact them before threatening legal action. 

Begin forwarded message: 


From:| 

Date: July 17,2008 10:29:31 AM PDT 

To i -1 

Subject: WLRKLAW.COM 


b6 
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I would like to know why our firm's website (wlrklaw.coiri) is being redirected to your website 
('ri 2 htsidecreative.net) . This error has been going on for the past week and our IT Department has been waiting 
for it to be fixed, to no avail. 

Failure to reply to this message and fix this error will result in legal action. A twenty-day summons will be 
processed at: 

I b6 

b7C 

United States 


Thank you for your prompt response. 


Wachtell, Lipton, Rosen & Katz 

51 West 52nd Street 

New York, New York 10019 

»T.» vl# *1# U# *1* *1* ^ ^ ^ ^ *1* 

^ ^ ^ V 'I* ^ ^ 'T* T 'v V 'T* < r* V 'T* -T* v 
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. Any tax advice contained in this communication is not intended or written to be used, and cannot be used, for 
the purpose of avoiding tax penalties and is not intended to be used or referred to in promoting, marketing or 
recommending a partnership or other entity, investment plan or arrangement. 

^ ^ ^ •I' ^ ^ ^ ^ ^ <}» 'I' ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ 

Please be advised that this transmittal may be a confidential attorney-client communication or may otherwise be 
privileged or confidential. If you are not the intended recipient, please do not read, copy or re-transmit this 
communication. If you have received this communication in error, please notify us by e-mail 
('helpdesk@wlrklaw.com') and delete this message and any attachments. Thank you in advance for your 
cooperation and assistance. 
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From: 

Sent: 

To: 

Subject: 


[ 


(Sullivan & Cromwell LLP) 


Friday, July 18, 2008 10:15 AM 


the e-mail I received 
Attachments: Client Referral 


you might want to have your IT people take a look at this 


[ 


] 
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This e-mail is sent by a law firm and contains information that may be privileged and confidential. If 
you are not the intended recipient, please delete the e-mail and notify us immediately. 


9/9/2008 










Frdm: I I 

Sefit: Friday. July 18. 20 08 12:05 PM 

To:'* I . I 

Subject: RE: Spoof'd WLRK e-mails 


By the way...the emails are being hosted by the hosting provider for the web site. If we were able to take the web page 
offline, we should be able to deactivate the email accounts also. 

mail.wlrklaw.com resolves to 64.202.165.92, and is a redirect to pop.where.secureserver.net at the same IP. 

> mail.wlrklaw.com 
Server: brddcon2.wlrk.com 
Address: 192.7.2.168 

Non-authoritative answer: 

Name: pop.where.secureserver.net 

Address: 64.202.165.92 

Aliases: mail.wlrklaw.com, pop.secureserver.net 

Likewise, smtp.wlrklaw.com resolves to smtp.secureserver.net... 

So his email is not going to a gmail or similar account unless he has a rule in his account at pop.secureserver.net 
redirecting emails elsewhere. 

I I 
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From: I I 

Se nt: Friday, July 18, 2008 11:59 AM 

To: I 

Cc:l I 

Subject: RE: Spoof d WLRK e-mails 


Yes, I am waiting on them now from 


I will send my separately. 


From: l I 

Sent: Friday, July 18, 2008 11:59 AM 

To: | 

Cc: l I 

Subject: RE: Spoofd WLRK e-mails 

Can you please send the original emails as attachments? 
Thank you. 

□ 
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From: I 

Sen t: Friday, July 18, 2008 11:57 AM _ 

To: I I 

Cc: | I 
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” „ Subject: Spoofd WLRK e-mails 

Importance: High 


We may have a bigger problem with this guy. I am getting the original e-mails sent out. 


As soon as I have it, we need to get hoping. 

I-1 


Fr om: I I _ 

To\ 

Sent: Fri Jul 18 11:38:19 2008 
Subject: Re: the e-mail I received 

Someone has been screwing with us this way. We will be right on it. 
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Fron d 

To j _ 

Sent: Fri Jul 18 10:24:02 2008 
Subject: FW: the e-mail I received 


See attached. This was received by at least 2 partners at S&C. We need to have someone 
look into it as soon as possible. 


1=1 
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From: | | 

Sent: Friday, July 18, 2008 10:15 AM 
To= l 1 

Subject: the e-mail I received 

you might want to have your IT people take a look at this 

I I 
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This e-mail is sent by a law firm and contains information that may be privileged and confidential. If you are 
not the intended recipient, please delete the e-mail and notify us immediately. 
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From:: 

Sent: 

To: 

Subjects 


c 


Friday, July 18 ,2008 4; Q 2 PM 


L 


RE: wlrklaw.com 


Follow Up Flag: Follow up 

Flag Status: Flagged 


Categories: 


Red Category 


□ I think we're onto something with that IP address (24.106.137.147). 

Edits from that IP also made changes to Greenburg Traurig's Wikipedia entry. 

Also, the Wikipedia user Lawinformationhelper made some unfavorable edits to the content. I have added myself to the 
watchlist for the Wikipedia page. We'll see if he slips again. 


From: I 

Se nt: Friday, July 18, 2008 3:41 PM 

To: I 

Subject: RE: wlrklaw.com 
Awesome. l I 
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From: ! I b6 

Se nt: Friday, July 18, 2008 3:40 PM _ b7c 

To: | 

Subject: RE: wlrklaw.com 
Importance: High 

Good news. I've been on the phone for the past hr with a manager @ Godaddy. I've convinced 
them to remove the gmail MX records for the wlrklaw.com domain until their investigation is 
completed. 


They would not give me control but they agreed to forward all inbound communications to their 
Abuse Dept. 

The records have already been removed on their end. 



From:Q 


] 


Sent: Friday, July 18, 2008 2:31 PM 

To:[ 


Subject: Re: wlrklaw.com 
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1 











i Ok, we need to do the same process with google. 
When did he set it up? 


From:l I b6 

To: I . I b7c 

Sent: FriJul 18 14:26:16 2008 
Subject: RE: wlrklaw.com 

One question. Has the name l b opped in in anyone else's radar? Apparently this guy (if its his real 

name of course) setup a Google Apps account with our name, see the following: 

https://www.qooqle.com/a/wlrklaw.com/DomainContact?service=iq 


From: I I 

Se nt: Friday. July 18. 2008 2:15 PM _ 

T° i I 

Subject: RE: wlrklaw.com 
Excellent... lets keep trying -- 

And if we have to, show postini the fake e-mail I forwarded around before. 


b6 

b7C 


From: I I 

Se nt: Friday. July 18. 2008 2:12 PM _ 

Toi l ~1 

Subject: RE: wlrklaw.com 

We have blocked wlrklaw.com from Postini; so no messages from that domain can be sent to 
internal users. I I and I are working to see if we can get Postini to help us in any way since 
they own Postini. 


b6 

b7C 


From: | ~| 

Se nt: Friday, July 18, 2008 1:55 PM _ 

To= l "I 

Subject: wlrklaw.com 


I have a 2:30 till about 4:3 0is appointment. Given where we are on this at the moment 
police); 


Ks point for the 


]are point for Google; and | | is point for GoDaddy, we are m a bit of a holding 


pattern. I do not know if the bb will work in the building I am going to, so I will try to check in from time to 
time. 


b6 

b7C 


Thanks, 

CZ3 


2 








[ 


From: I I 

Sent: Monday, July 21, 2008 11:56 AM 

To: 'The Gooale Team 1 _ 

Cc: 

Subject: RE: [#309280483] eps10502 


Thank you for your reply. 

We would just like to clarify that in this case, the abuse is occurring from one of your 
Google Apps customers who is registered under the domain wlrklaw.com. This person is using 
your Gmail services to impersonate members of our firm and send fraudulent messages. We ask 
that you suspend this account while you conduct your investigation. If you need addit ion 
information concern ing this case, please don't hesitate to contact me at I l or at 

\ \ If there is a direct phone line or email address that I can use to 

conduct further communications with you, please let me know. Thank you for your assistance 
with this matter. 


b6 

b7C 


Sincerely, 


Wachtell, Lipton, Rosen & Katz 


-Original Message- 

From: The Google Team [mailto:mail-support@google.com] 

Sent: Monday, Duly 21, 2008 1:01 AM 

To: I I 

Subject: Re: [#309280483] epsl0502 
Hello, 

Thank you for your report. 

We apologize for any inconvenience this may have caused. 

When we are notified of such issues, we investigate and take appropriate action if we find 
that the Gmail Terms of Use have been violated. To read the Gmail Terms of Use, please visit: 
http://mail.google.com/gmail/help/terms of use.html . 

We appreciate your concern, and thank you for taking the time to send us your comments. 


Sincerely, 

The Google Team 


l 











b6 

b7C 


From: The Google Team [mail-support@google.com] 

Sent: Monday, July 21, 20 08 1:01 AM 

To: I I 

Subject: Re: [#309280483] eps10502 


Hello, 

Thank you for your report. 

We apologize for any inconvenience this may have caused. 

When we are notified of such issues, we investigate and take appropriate action if we find 
that the Gmail Terms of Use have been violated. To read the Gmail Terms of Use, please 
visit: http://mail.google.com/gmail/help/terms_of_use.html. 

We appreciate your concern, and thank you for taking the time to send us your comments. 


Sincerely, 

The Google Team 


1 
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(link) 98.206.148.133 (Talk) 
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Line 4: 


(9 intermediate revisions not shown.) 

Line 4: 


headquarters = [[Image:Flag of the United 
States.svg|20px]] [[New York City]] | 
foundation = [[1965]] | 

-hum offices = 2 I 

......... 

“ jnum^attomeys = about 200 j. 

practice_areas = General practice | 
revenue = $474 million | 
date_founded = [[1965]] ([[New York City]]) | 
company_type = [[general partnership]] | 

[homepage = [http://www.wirklaw.com 
” iwww.wlrklaw.comj 

>> . .. 

"'Wachtell, Lipton, Rosen & Katz"' is a prominent [[law 
firm]] located in [[New York City]]. [[Herbert 
Wachtell]], [[Martin Lipton]], Leonard Rosen, and 
George Katz founded the firm in [[1965]].<ref> 
[http://wwwl.excite.com/home/careers/company_profile 
/0,15623,1173,00.html The Scoop: Wachtell, Lipton, 
Rosen & Katz]</ref> It has for some time been the most 
profitable large law firm in the world on a per-partner 
basis according to the "[[American Lawyer]]^" annual 
[[AmLaw 100 Survey]]. The firm also ranks at the top 
of other various surveys, including the [[Vault.com 
Associates Survey]] and was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 
Averylndex .<re£> 

[http://www.averyindex.com/2007_best_work_prestigio 
us.php 2007 Law Firm Rankings]</ref> Wachtell is 
generally considered one of the most difficult law firms 
at which to be hired: summer classes at Wachtell 
number in the low dozens and are composed of the 
strongest applicants from top [[law school]]s. Its 
associates are generally paid substantially more than 
associates at any other firm in the country. The firm is 
smaller, and has a lower associate-to-partner ratio, than 
its peer firms, such as [[Cravath, Swaine & Moore]]. 

Line 21: 


headquarters = [[Image:Flag of the United 
States.svg|20px]] [[New York City]] | 
foundation = [[1965]] | 



practice_areas = General practice | 
revenue = $474 million | 
date_founded = [[1965]] ([[New York City]]) | 
company_type = [[general partnership]] | 

+ homepage = [http://www.wirk.com www.wlrk.com] 

}} 

"'Wachtell, Lipton, Rosen 8c Katz'" is a prominent [[law 
firm]] located in [[New York City]]. [[Herbert 
Wachtell]], [[Martin Lipton]], Leonard Rosen, and 
George Katz founded the firm in [[1965]].<ref> 
[http://wwwl.excite.com/home/careers/company_profile 
/0,15623,1173,00.html The Scoop: Wachtell, Lipton, 
Rosen & Katz]</re£> It has for some time been the most 
profitable large law firm in the world on a per-partner 
basis according to the "[[American Lawyer]]'s" annual 
[[AmLaw 100 Survey]]. The firm also ranks at the top 
of other various surveys, including the [[Vault.com 
Associates Survey]] and was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 
Averylndex .<ref> 

[http://www.averyindex.com/2007_best_work_prestigio 
us.php 2007 Law Firm Rankings]</ref> Wachtell is 
generally considered one of the most difficult law firms 
at which to be hired: summer classes at Wachtell 
number in the low dozens and are composed of the 
strongest applicants from top [[law school]]s. Its 
associates are generally paid substantially more than 
associates at any other firm in the country. The firm is 
smaller, and has a lower associate-to-partner ratio, than 
its peer firms, such as [[Cravath, Swaine & Moore]]. 

Line 21: 


*[[Bemard Nussbaum]], partner — Former Counsel to *[[Bemard Nussbaum]], partner — Former Counsel to 
the President of the United States under the Clinton the President of the United States under the Clinton 

Administration Administration 
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*[[Chaim Fortgang]], partner & former Head of the 
bankruptcy department - "involved in almost every 
headline bankruptcy of the [1990's] and beyond<re£> 
{{cite web | title=The Sunbeam Boys: In Big 
Bankruptcy Battle It’s Chaim Fortgang Vs. Harvey 
Millers] url=http://www.observer.com/node/44042 

:J accessmonthday=April 17 | accessyeai=2008 }} 
!</ref>,<ref> { {cite web | titie=Wharton’s Inaugural 
[Restructuring Conference | 

|url=http://clubs.wharton.upenn.edu/wrc/conference/200 
i5AVRCC_attendee_guide.pdf |publisher=Wharton 5 s 
[Inaugural ^structuring Conference |page=4 

| accessmonthday=April 17 | accessyear=2008 }}</ref> 
^[[Elizabeth Holtzman]], associate — former U.S. 
Representative and Brooklyn District Attorney 


*[[Chaim Fortgang]], partner & former Head of the 
bankruptcy department - "involved in almost every 
headline bankruptcy of the [1990's] and beyond<re£> 
{{cite web | title=The Sunbeam Boys: In Big 
Bankruptcy Battle It's Chaim Fortgang Vs. Harvey 
Millers] url=http://www.observer.com/node/44042 

| accessmonthday=April 17 | accessyeai=2008 }} 
</refxref>{{cite web | title=Wharton’s Inaugural 
_ Restructuring Conference | 
url=http://clubs.wharton.upenn.edu/wrc/conference/200 
5AVRCC_attendee_guide.pdf |publishex=Wharton ’ s 
Inaugural Restructuring Conference |page=4 _ 


| accessmonthday=April 17 | accessyeai=2008 }}</re£> 
^[[Elizabeth Holtzman]], associate — former U.S. 
Representative and Brooklyn District Attorney 


Current revision as of 09:13,4 September 2008 

Wachtell, Lipton, Rosen & Katz is a prominent 
law firm located in New York City. Herbert 
Wachtell, Martin Lipton, Leonard Rosen, and 

George Katz founded the firm in 1965U It has 
for some time been the most profitable large law 
firm in the world on a per-partner basis according 
to the American Lawyer's annual AmLaw 100 
Survey. The firm also ranks at the top of other 
various surveys, including the Vault.com 
Associates Survey and was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 

Avery Index. ^ Wachtell is generally considered 
one of the most difficult law firms at which to be 
hired: summer classes at Wachtell number in the 
low dozens and are composed of the strongest applicants from top law schools. Its associates are 
generally paid substantially more than associates at any other firm in the country. The firm is smaller, 
and has a lower associate-to-partner ratio, than its peer firms, such as Cravath, Swaine & Moore. 

The firm is known for its skill in mergers and acquisitions. One of the founding partners, Martin 
("Marty") Lipton invented the so-called "poison pill defense" during the 1980s to foil hostile takeovers. 
Working both sides of the mergers and acquisitions game, Wachtell Lipton has represented blue-chip 
clients like AT&T, Kraft, and JP Morgan Chase. 

The firm is also known for its skill in business litigation. It has handled many of the precedent-setting 
Delaware corporate governance cases. One of their most recent clients was Larry Silverstein, owner of 
the two 110-story towers of the World Trade Center. Videos of another one of the founding partners, 
Herb Wachtell, arguing cases in the courtroom are shown in law school classes as examples of effective 
trial advocacy. 


Wachtell, Lipton, Rosen & Katz 

Wachtell, Lipton, Rosen & Katz 

Headquarters 

Bli New York City 

No. of Offices 

1 

No. of Attorneys 

217 

Major Practice Areas 

General practice 

Revenue 

$474 million 

Date Founded 

1965 (New York City) 

Company Type 

general partnership 

Website 

www.wlrk.com 
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■ 1 Famous alumni 

■ 2 See also 

■ 3 References 

■ 4 External links 


Famous alumni 

■ Bernard Nussbaum, partner — Former Counsel to the President of the United States under the 
Clinton Administration 

■ Chaim Fortgang, partner & former Head of the bankruptcy department - "involved in almost every 

headline bankruptcy of the [1990's] and beyond^ 4 ] 

■ Elizabeth Holtzman, associate — former U.S. Representative and Brooklyn District Attorney 

■ John Coates, partner — Harvard Law Professor 

■ Jed Rubenfeld, associate — Yale Law Professor 

■ Peter Shuck — Yale Law Professor 

■ Janet Langford Kelly — General Counsel, ConocoPhillips 

■ George Postolos, associate — former President and CEO of Houston Rockets 

■ David Lat, associate — Blogger, Underneath Their Robes and Above the Law 

See also 

■ White shoe firms 

■ The Magic Circle 
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External links 

■ Official website 

■ LawPeriscope Profile 

■ US Top 50/New York: What Marty says ... 

■ WLRK Named Top Law Firm for Prestige, Says New Top 100 Vault Guide; Firm Takes Top 
Ranking in BestSelling Vault Guide for Fourth Straight Year 

■ Profile: Wachtell Lipton Rosen & Katz 
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Line 4: 


headquarters = [[Image:Flag of the United 

States.svg|20px]] [[New York City]] | 
foundation = [[1965]] | 

headquarters = [[Image:Flag of the United 

States.svg|20px]] [[New York City]] | 
foundation = [[1965]] | 

bum offices = 2 1 

-f|num offices = 11 I 

bum attorneys = about 200 | 

+ [num attorneys = 217 | 1 

practice_areas = General practice | 
revenue = $474 million | 
date_founded = [[1965]] ([[New York City]]) | 
company_type = [[general partnership]] | 

practice_areas = General practice | 
revenue = $474 million | 
date_founded = [[1965]] ([[New York City]]) | 
companyjype = [[general partnership]] | 

jhomepage = [http://www.wlrklaw.com 
•www.wlrklaw.com] 

+ 

homepage = [http://www.wlrk.com www.wlrk.com] 


}} 

'"Wachtell, Lipton, Rosen & Katz'" is a prominent [[law 
firm]] located in [[New York City]]. [[Herbert 
Wachtell]], [[Martin Lipton]], Leonard Rosen, and 
George Katz founded the firm in [[1965]].<re£> 
[http://wwwl.excite.com/home/careers/company_profile 
/0,15623,1173,00.html The Scoop: Wachtell, Lipton, 
Rosen & Katz]</ref> It has for some time been the most 
profitable large law firm in the world on a per-partner 
basis according to the "[[American Lawyer]]'s" annual 
[[AmLaw 100 Survey]]. The firm also ranks at the top 
of other various surveys, including the [[Vault.com 
Associates Survey]] and was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 
Avery Index .<ref> 

[http://www.averyindex.com/2007_best_work_prestigio 
us.php 2007 Law Firm Rankings]</re£> Wachtell is 
generally considered one of the most difficult law firms 
at which to be hired: summer classes at Wachtell 
number in the low dozens and are composed of the 
strongest applicants from top [[law school]]s. Its 
associates are generally paid substantially more than 
associates at any other firm in the country. The firm is 
smaller, and has a lower associate-to-partner ratio, than 
its peer firms, such as [[Cravath, Swaine & Moore]]. 

Line 21: 

*[[Bemard Nussbaum]], partner — Former Counsel to 
the President of the United States under the Clinton 
Administration 


}} 

"Wachtell, Lipton, Rosen & Katz"' is a prominent [[law 
firm]] located in [[New York City]]. [[Herbert 
Wachtell]], [[Martin Lipton]], Leonard Rosen, and 
George Katz founded the firm in [[1965]].<re£> 
[http://wwwl.excite.com/home/careers/company_profile 
/0,15623,1173,00.html The Scoop: Wachtell, Lipton, 
Rosen & Katz]</re£> It has for some time been the most 
profitable large law firm in the world on a per-partner 
basis according to the "[[American Lawyer]]'s" annual 
[[AmLaw 100 Survey]]. The firm also ranks at the top 
of other various surveys, including the [[Vault.com 
Associates Survey]] and* was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 
Averylndex ,<ref> 

[http://www.averyindex.com/2007_best_work_prestigio 
us.php 2007 Law Firm Rankings]</re£> Wachtell is 
generally considered one of the most difficult law firms 
at which to be hired: summer classes at Wachtell 
number in the low dozens and are composed of the 
strongest applicants from top [[law school]]s. Its 
associates are generally paid substantially more than 
associates at any other firm in the country. The firm is 
smaller, and has a lower associate-to-partner ratio, than 
its peer firms, such as [[Cravath, Swaine & Moore]]. 

Line 21: 

*[[Bemard Nussbaum]], partner — Former Counsel to 
the President of the United States under the Clinton 
Administration 
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*[[Chaim Fortgang]], partner & former Head of the 
bankruptcy department - "involved in almost every 
headline bankruptcy of the [1990 T s] and beyond<ref> 
{{cite web | title=The Sunbeam Boys: In Big 
Bankruptcy Battle It's Chaim Fortgang Vs. Harvey 
Millers] url=http://www.observer.com/node/44042 

:| accessmonthday=April 17 | accessyeai=2008 }} 
j</ref> a <ref>{{cite web | title=Wharton’s Inaugural 
•Restructuring Conference | 

|url=http://clubs.wharton.upenn.edu/wrc/conference/200 
i5AVRCC_attendee_guide.pdf |publisher=Wharton 5 s 
jlnaugural Res [page=4 ^ 

| accessmonthday=April 17 | accessyear=2008 }}</ref> 
*[[Eiizabeth Holtzman]], associate — former U.S. 
Representative and Brooklyn District Attorney 


*[[Chaim Fortgang]], partner & former Head of the 
bankruptcy department - "involved in almost every 
headline bankruptcy of the [1990's] and beyond<ref> 
{{cite web | title=The Sunbeam Boys: In Big 
Bankruptcy Battle It's Chaim Fortgang Vs. Harvey 
Millers] url=http://www.observer.com/node/44042 


+ 


| accessmonthday=April 17 | accessyear=2008 }} 
</re£xref>{{cite web | title=Wharton’s Inaugural 
Restructuring Conference | 

url=http://clubs.wharton.upenn.edu/wrc/conference/200 
5AVRCC_attendee_guide.pdf |publisher=Wharton’s 
Inaugural Restructuring Conference ]page=4 _ 

accessmonthday=April 17 | accessyear=2008 }}</ref> 
*[ [Elizabeth Holtzman]], associate — former U.S. 
Representative and Brooklyn District Attorney 


Current revision as of 09:13,4 September 2008 

Wachtell, Lip ton, Rosen & Katz is a prominent 
law firm located in New York City. Herbert 
Wachtell, Martin Lipton, Leonard Rosen, and 

George Katz founded the firm in 1965.^ It has 
for some time been the most profitable large law 
firm in the world on a per-partner basis according 
to the American Lawyer's annual AmLaw 100 
Survey. The firm also ranks at the top of other 
various surveys, including the Vault.com 
Associates Survey and was ranked as the #1 Most 
Prestigious Law Firm to Work For by the 

AverylndexJ 2 ] Wachtell is generally considered 
one of the most difficult law firms at which to be 
hired: summer classes at Wachtell number in the 
low dozens and are composed of the strongest applicants from top law schools. Its associates are 
generally paid substantially more than associates at any other firm in the country. The firm is smaller, 
and has a lower associate-to-partner ratio, than its peer firms, such as Cravath, Swaine & Moore. 

The firm is known for its skill in mergers and acquisitions. One of the founding partners, Martin 
("Marty") Lipton invented the so-called "poison pill defense" during the 1980s to foil hostile takeovers. 
Working both sides of the mergers and acquisitions game, Wachtell Lipton has represented blue-chip 
clients like AT&T, Kraft, and JP Morgan Chase. 

The firm is also known for its skill in business litigation. It has handled many of the precedent-setting 
Delaware corporate governance cases. One of their most recent clients was Larry Silverstein, owner of 
the two 110-story towers of the World Trade Center. Videos of another one of the founding partners, 
Herb Wachtell, arguing cases in the courtroom are shown in law school classes as examples of effective 
trial advocacy. 


Wachtell, Lipton, Rosen & Katz 

Wachtell, Lipton, Rosen & Katz 

Headquarters 

S3 New York City 

No. of Offices 

1 

No. of Attorneys 

217 

Major Practice Areas 

General practice 

Revenue 

$474 million 

Date Founded 

1965 (New York City) 

Company Type 

general partnership 

Website 

www.wlrk.com 
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■ 1 Famous alumni 

■ 2 See also 

■ 3 References 

■ 4 External links 


Famous alumni 

■ Bernard Nussbaum, partner — Former Counsel to the President of the United States under the 
Clinton Administration 

■ Chaim Fortgang, partner & former Head of the bankruptcy department - "involved in almost every 

headline bankruptcy of the [1990'sl and beyond^ 4 ! 

■ Elizabeth Holtzman, associate — former U.S. Representative and Brooklyn District Attorney 

■ John Coates, partner — Harvard Law Professor 

■ Jed Rubenfeld, associate — Yale Law Professor 

■ Peter Shuck — Yale Law Professor 

■ Janet Langford Kelly — General Counsel, ConocoPhillips 

■ George Postolos, associate — former President and CEO of Houston Rockets 

■ David Lat, associate — Blogger, Underneath Their Robes and Above the Law 

See also 

■ White shoe firms 

■ The Magic Circle 
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Retrieved on April 17, 2008. 

External links 

■ Official website 

■ LawPeriscope Profile 

■ US Top 50/New York: What Marty says... 

■ WLRK Named Top Law Firm for Prestige, Says New Top 100 Vault Guide; Firm Takes Top 
Ranking in BestSelling Vault Guide for Fourth Straight Year 

■ Profile: Wachtell Lipton Rosen & Katz 

Retrieved from "http://en.wikipedia.org/wiki/Wachtell,_Lipton,_Rosen_%26_Katz" 

Categories: Law firms of the United States | Law firms based in New York City | Law firms established 
in 1965 
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% http://who.godaddy.com/WhoIs.aspx?domain=wlrklaw.com&prog_id=godaddy 


Favorites Tools Help 


▼ j Go ^ Bookmarks-r j '^/’ Cheb 


stomize Links DFM •*<-> Dsview g, EVDA 'n IBM BladeCenter g, KVS Enterprise Vault - Advanced Search. 


Whols Search Results 


Please note: the registrant of the domain name is specified 
in the "registrant 1 field. In most cases, GoDaddy.com, Inc. 
is notthe registrant of domain names listed in this database. 


Registrant: 
Godaddy Software 


14455 N Hayden Rd 
Suite 219 

Scottsdale, AZ 85260 
United States 

Registered through: GoDaddy.com, Inc. (http:/Awww.godaddy.com) 

Domain Name: WLRKLAW.COM 

Created on: 27-Jun-08 

Expires on: 27-Jun-15 

Last Updated on: 08-Jul-08 

Administrative Contact: 

domains for sale, Godaddy Software domains4sale@godaddy.com 
Godaddy Software 
14455 N Hayden Rd 
Suite 219 

Scottsdale, AZ 85260 
United States 

480-505-8800 Fax - 480-505-8844 
Technical Contact: 

domains for sale, Godaddy Software domains4sale@godaddy.com 
Godaddy Software 
14455 N Hayden Rd 
Suite 219 

Scottsdale, AZ 85260 
United States 

480-505-8800 Fax - 480-505-8844 

Domain servers in listed order: 

NS09.DOMAINCONTROL.COM 
NS10.DOMAINCONTROL.COM 


Registry Status: clientDeleteProhibited 
Registry Status: clientRenewProhibited 
Registry Status: clientTransferProhibited 
Registry Status: clientUpdateProhibited 


Report Invalid Whois 


See Underlying Registry Rata 

/v t ~7r a s' 
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> set type=AM Y 

> [sullcro ml ay v. com 1 
Server: brddcon27wlrk.com 
Address: 192.7.2.16S 


Non-authoritative answer: 

sullcromlaw.com internet address - 72.167.131.75 
sullcromlaw.com nameserver = ns09.domaincontrol.com 
sullcromlaw.com nameserver - nslO.domaincontrol.com 
sul 1 croml aw. com 

primary name server = ns09.domaincontrol. com 
responsible mail addr - dns.jomax.net 
serial = 2008071700 
refresh = 28800 (8 hours) 
retry = 7200 (2 hours) 
expire = 604800 (7 days) 
default TTL - 86400 (1 day) 
sullcromlaw.com MX preference = 10. mail exchanger = 

sullcromlaw.com MX preference = 20, mail exchanger - 

sullcromlaw.com MX preference = 30. mail exchanger = 

sullcromlaw.com MX preference = 40, mail exchanger = 

sullcromlaw.com MX preference - 50*. mail exchanger = 


aspmx.1.google.com 
altl.aspmx.1.google.com 
alt2.aspmx.1.google.com 
aspmx2.googlemai1.com 
aspmx3.googlemail.com 


ns09.domaincontrol.com internet address 
nslO.domaincontrol.com internet address 
aspmx.1.google.com internet address 
aspmx.1.google.com internet address 

altl.aspmx,1.google.com internet address 
al11.aspmx.l.google.com internet address 
alt2.aspmx.1.google.com internet address 
aspmx2.googlemai1.com internet address 
aspmx3.googlemail.com internet address 
>|gr eenbergtrauri g f aw. com"! 
ServerT^~brddcon27w|\krcom 
Address: 192.7.2.168 


64.202.165.114 
208.109.255.5 

66.249.83.114 

66.249.83.27 

64.233.183.114 

64.233.183.27 

72.14.253.27 

209.85.135.27 

64.233.167.27 




Non-authoritative answer: 

greenbergtrauriglaw.com internet address = 68.178.232.100 
greenbergtrauriglaw.com nameserver = ns51.domaincontrol.com 
greenbergtrauriglaw.com nameserver = ns52.domaincontrol.com 
greenbergtrauriglaw.com 

primary name server = ns51.domaincontrol.com 
responsible mail addr = dns.jomax.net 
serial = 2008062100 
refresh = 28800 (3 hours) 
retry = 7200 (2 hours) 
expire = 604800 (7 days) 
default TTL = S6400 (1 day) 
greenbergtrauriglaw.com MX preference = 10, 
greenbergtrauriglaw.com MX preference = 20, 
greenbergtrauriglaw.com MX preference = 30. 


greenbergtrauriglaw.com MX preference = 40. 
greenbergtrauriglaw.com MX preference = 50. 


mail 

mail 

mail 

mail 

mail 


exchanger 

exchanger 

exchanger 

exchanger 

exchanger 


aspmx.1.google.com 
altl,aspmx.1.google, com 
alt2.aspmx.1. google, com 
aspmx2.googlemai1.com 
aspmx3.googlemai1.com 


ns51.domaincontrol.com internet address = 208.109,14.47 ^ 

ns52.domaincontrol.com internet address - 208.109.255.26^^ 

aspmx2.googlemail.com internet address - 209.85.135,27 

aspmx3.googlem ai 1.com internet address - 64.233.167.27 

>Iwi r kT aw. com J ~~ ’ 

Server: brddcon2.wlrk.com 
Address: 192.7.2.168 


Non-authoritative answer: 

wlrklaw.com nameserver - nsl.suspended-for.spam-and-abuse.com 

wlrklaw.com nameserver = ns2.suspended-for.spam-and-abuse.com 

nsl.suspended-for.spam-and-abuse.com internet address = 64.202.167.73 
ns2.suspended-for.spam-and-abuse. com internet address = 64.202.167.74 

> - 



Carlo Mauro • Chief Technologist 

Wachtell, Lipton, Rosen & Katz 

51 West 52nd Street • New York, NY 10019 

(212) 403-1540 (Direct Phone) • (212) 403-4540 (Direct Fax) 
cmauro@WLRK.com • www.wirk.com • vCard 
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U.S. Department of Justice 




Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 


26 Federal Plaza 
New York, NY 10278 

August 19, 2008 


Google 


1600 Amphitheatre Parkway, Building #47 
Mountain View, CA 94043 


via facsimile: 


RE: sullcrom@gmail.com 


Dear I I : 

Pursuant to Title 18, United States Code, Section 
2703(f), you are directed to preserve all records and information 
in Google's possession including, but not limited to, accounts, 
logs, files, communications, email messages, programs, client 
account records and any other documents pertaining to the email 
address: sullcrom@gmail.com. 

This request is made in anticipation of an appropriate 
judicial order requiring the production of all information 
(including content) pursuant to the Electronic Communication 
Transactional Records Act, 18 U.S.C §§ 2701, et. seq. Pursuant 
to Section 2703 (f), you are required to preserve these items for 
a period of ninety days. This period is subject to renewal. 

Please be advised that your failure to comply with this 
request may subject you to criminal penalties. As this request 
is made pursuant to an ongoing criminal investigation, you are 
requested not to disclose this request to anyone. If you have 
any questions or need additional information, pleas e contact 
Special Agent I I 


Sincerely, 


David A. Cardona 
Special Agent In Charge 



b6 

b7C 


b6 

b7C 


Supervisory Special Agent 

















U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 2 6 Federal Plaza 

FileNo ' New York, NY 10278 

August 19, 2008 

Yahool Inc. 

701 First Ave, Bldg. D 
Sunnyvale, CA 94089 


via facsimile: 


RE: sul1crom@yahoo.com 


b6 

b7C 


Pursuant to Title 18, United States Code, Section 
2703 (f), you are directed to preserve all records and information 
in Google's possession including, but not limited to, accounts, 
logs, files, communications, email messages, programs, client 
account records and any other documents pertaining to the email 
address: sullcrom@yahoo.com. 

This request is made in anticipation of an appropriate 
judicial order requiring the production of all information 
(including content) pursuant to the Electronic Communication 
Transactional Records Act, 18 U.S.C §§ 2701, et. seq. Pursuant 
to Section 2703 (f), you are required to preserve these items for 
a period of ninety days. This period is subject to renewal. 

Please be advised that your failure to comply with this 
request may subject you to criminal penalties. As this request 
is made pursuant to an ongoing criminal investigation, you are 
requested not to disclose this request to anyone. If you have 
any questions or need additional information, plea se contact 
Special Agent I I 


Sincerely, 

David A. Cardona 
Special Ageiyt In Charge 
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Supervisory Special Agent 


















FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 08/20/2008 

To: New York Attn: C-37 



Title: UNSUB(s) 

Sullivan & Cromwell LLP; 
Wachtell, Lipton, Rosen & Katz; 
Greenberg Traurig, LLC - Victims 
CIP 
00: NY 


Synopsis: Claim Statistical Accomplishment 

Details: On August 20, 2008, SA_sent out a 

2703 (f) letter to Google, 1600 Amphitheater Parkway, Mountain 
View, CA, 94043, and to Yahool, Inc., 701 First Avenue #D, 
Sunnyvale, CA, 94089. 







To: 
Re: 


New York 


Fr^^: 


New York 


2 8 8A-NY-300570, 08/20/2008 



Accomplishment Information: 
Number: 2 

Type: CIP 2703(f) ORDER SERVED 

ITU: CIP 

Claimed By:_ 

SSN: | 

Name: |_ 

Squad: C3 7 
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To: 
Re: 


New York Frcmn 
2 88A-NY-3 00570, 


New York 
08/20/2008 


LEAD(s)s 

Set Lead 1: (Info) 

NEW YORK 

AT NEW YORK, NEW YORK 
Read and clear. 

♦♦ 


3 
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FEDERAL BUREAU OF INVESTIGATION 



Precedence : ROUTINE 

To : New York 

From: New York 

c ' 3 r 

Contact: [_ 
Approved By: i 


Drafted By: |_| 

Case ID #: 288A-NY-300570 (Pending) 

188B-NY-294567-C (Pending) 

Title: VICTIM NOTIFICATION FORM 

Synopsis: Computer Intrusion 

Reference: 288A-NY-300570 Serial 1 


Date: 9/08/2008 


Details: 

VnsCase# 

CAgtName 

PContact 

BusName 

BusEIN 

BusAcct 

VicFirN 

VicMidN 

VicLastN 

SSAN 

VicDate 

VicDOD 

VicMinor 

DOB 

Race 

Sex 

Addr 

Addr2 

City 

State 

Country 

Zip 

Email 

HPhone 

Fax 


288A-NY-300570 


Business 

Sullivan & Cromwell LLP 






To: 
Re: 


New York From: New York 
288A-NY-300570, 9/08/2008 


VWrkAddr 

VWrkadd2 

WrkCity 

VWrkSt 

VWrkCtry 

VWrkZip 

WEmail 

WPhone 

WFax 

VicPager 

NOKFirN 

NOKMidN 

NOKLastN 

NOKRel 

NOKAddr 

NOKAddr2 

NOKCity 

NOKState 

NOKCtry 

NOKZip 

NOKHEmal 

NOKWEmal 

NOKHPho 

NOKWPho 

NOKHFax 

NOKWFax 

NOKPager 

GrdFirN 

GrdMidN 

GrdLastN 

GrdRel 

GrdAddr 

GrdAddr2 

GrdCity 

GrdState 

GrdGtry 

GrdZip 

GrdHEmal 

GrdWEmal 

GrdHPho 

GrdWPho 

GrdHFax 

GrdWFax 

GrdPager 

PropRet 

TotLoss 

Lang. 

Disable 


125 Broad Street 

New York 

NY 

US 

10004-2498 

2125584000 


N 

000000000 


2 








To: New York From: New York 

Re: 288A-NY-300570, 9/08/2008 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 


08/25/2008 


|_ _ I Of SULLI VA N MI) 

CROMWELL, LLP law firm ,125 ~Bifroa"d Street ,~ New * YorJc’,’ New "York,. * *" 

10004-2498, business telephone number 1 | and |_ 

I I’ Va rtner “at SULLIVAN AND CROMWELL, LLP (S&C) y ' businpss 

phone num b er I l ^were 'interviewed at the' Assistant 

United States"Attorney 1 ’^office in the Southern District of New 
York, 1 Sai nt Andrew's jP laza, New York, New York, 10007. Also 
present was | [ Computer Scientist with the FBI. After 

bei ng advised of the ifdentity of the interviewing Agents, | 
and I I provided^ the following information: 


_ On July 17, 2008, an E -Mail was se nt to |_| 

I I a partner at S&C, from I I a partner at WACHTELL, 

LIPTON, ROSEN, AND KATZ (WLRK) law firm. I I forwarded the E- 

Mail to I I and explained that he found the E-Mail suspicious 

because the return E-Mail address had a domain name of 
"wlrklaw.com." The correct domain name for WLRK is "wlrk.com." 

I I subsequently did a sear ch of the S&C computer gateways and 

found that three S&C partners, I I 

I I received the same or a similar E-Mail from the same 

source. 

On July 24, 2008, an E-Mail was sent to I l 

an Account Executive at HUBBARD ONE, a firm that assists S&C with 
maintaining its website, asking for all the existing files for the 
WWW .sul1crom.com w ebsite in a co mpressed folder (.zip format). The 
E-Mail was signed 1 | Sullivan & Cromwell." The writer 

of the E-Mail stated that he was the new IT Department Team Leader 
and that S&C was thinking about moving to a new website. 


to know 


I_I fir st came to know about the computer intrus ion on 

August 6, 2008, when |_ of 

WLRK, called him and advised that the S&C entry on 
www.wikipedia.com (WIKI) had been changed on July 26, 2008, to 
reflect incorrect information about the firm. Specifically, the 
link to the S&C website found at the end of the WIKI entry was 

changed from www.sullcrom.com to www.sul1cromlaw.com . When _ 

clicked the www.sullcromlaw.com link found in the WIKI entry, the 
web page www.sullcromlaw.com opened and. resembled the legitimate 
S&C website. However, the contact E-Mail addresses for some 700 
lawyers had been changed. Between July 26, 2008 and August 14, 


investigation on 8/19/2008 at New York, New York 


File# 288A-NY-300570 
SA 

by SA _ 


Date dictated 


piis document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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8/19/2008 


2008,| | had to change the link in WIKI multiple t arries be cause 

someone kept changing it back to www.sullcromlaw.com. I I 

informed I I that the WIKI entries were changed for WKLR, S&C, 

the law firm GREENBERG TRAURIG (GT), and that the changes were made 
by a user with the same IP address. 

I 1 discovered that www.sullcromlaw.com was being 

hosted through www.godaddy.com (GODADDY). On August 8, 2008, S&C 
sent GODADDY a copyright infringement claim in order to shut down 
www.sullcromlaw.com. GODADDY subsequently removed the 
www.sullcromlaw.com website from its servers. Additionally, | | 

attempted to have sullcrom@google.com removed by contacting GOOGLE. 

On August 13, 2008', | notified _ 

that although www.sullcromlaw.com was registered with GODADDY, 
GOOGLE APS was used for E-Mail. 


I I advised that the S&C, WLRK, and GT law firms all 

handle large corporate mergers and acquisitions. Sometimes large 
companies communicate with S&C person nel via E-Mail to discuss 
future merger and acquisition plans. | | thinks that someone 

may be trying to phish the legitimate S&C website, intercept E-Mail 
messages, and possibly obtain insider information. | |stated 

that no blackmailing attempts or personal threats have been 
directed towards any S&C personnel. 

When asked if I 1 is aware of any disgruntled current 

or former employees, or any employees w ho have be en recently 
terminated, he stated that he did not. | | stated that I I 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/17/2008 


I 






Drive, Na ples') Florida, 34103-2413, 
I I cellular telephone nui 


r~LXR'Luxury IfesQpiirand Hotels, 475 Sea gate 


fans i nfass t q 1 snh nns number 


was 


telephonically. 
interviewing Agent,[ 


_ _interviewed 

After being advised of the identity of the 


* 




b6 

b7C 


] 


J**^rovided the following information: 


—^ 

Internet Protocol (IP) addresses 65.244*5 s f46.210 and 
65.244.146.212 are assigned to The JNap Xes Grand^B each Resort, 

Naples, Florid a. 65.244.146.210 is a private IP address used as an 

internal gateway to the internet. 65.24,4^146.212 is a public 
address that was assigned to a particular user at a particular 
time. When resort guests wish to connect to the internet from 
their personal computers, they log on to the resort's internet 
access page, fill out an online form with information such as their 
name and room number, select a billing method, and pay for internet 
access. Internet access for a 24 hour period can be purchased for 
$10.95. Guests may choose to purchase internet acces s for a l onger 
time period and are subsequently billed accordingly. | ~| has 

access to logs that record the IP and internet traffic within the 
Naples Grand Beach Resort computer system and can see what resort 
guests utilized those IP addresses. 
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| stated that at approximately 3:36 P.M. on August t>6 

9, 2008, a resort guest utilizing IP address 65.244.146.210 paid b7c 

$10.95 for 24 hour interne t access. On the online form, the guest 


I ~1 stated that at approximately 3:52 P.M. on August b6 

9, 2008, a resort guest utilizing IP address 65.244.146.212 paid b7c 

$10.95 for 24 hour internet acce ss. On the online form, the guest 


I ~l added that acc ording to the logs, it appeared b6 

that on both occasions, | | billed the $10.95 to room number b7c 

1205. 


investigation on 09/15/2008 at New York, New York _ (telephonically) 

File # 2'8 8A-NY- 3 0057 0 Date dictated 

by SA f 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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1 


On September 17, 2008. Federal Bureau of Investigation 
Special Agent I I requested a Florida Departme nt of 

Motor Vehicles driver's license photo for I I 

Florida driver's license number I L | 

I I provided a copy of the photo via E-Mail. 












288A-NY-300570 
PB :pb 


1 


On September 22,. 2008. Federal Bureau of Investigation 
Special Agent I I requested a Florida Depart ment of 

Motor Vehicles driver's license photo for I I 

Florida driver's license number | ~| 

I provided a copy of the photo via E-Mail. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/24/2008 


I _ _ _ _ [ GREENBERG 

TRAURIG, LLP (GT), 1750 Tvsons Boulej^rd. Sui te 1200. McL ean. 
Virginia. 22102. business telephone number I T cellula r 

telephone .number I jX was interviewed at the New York 

field office of the FBI, 26 Fed eral Pi Dtivp. Mfaw YnrV. 

York, 10278. Also present was | with 

the FBI . Afte r being advised of the identity of’the interviewing 
Agents, I I provided the following information: 

On June 25, 2008, I I learned that | a 

shareholder of GT, received a phone call from a representative of 
Google concerning the p urchasi ng of a premium support service in 
the amount o f $25,000. I I then contac ted Google representative 

I l phone nu mber I \ wh o inf ormed him that a 

person by the name of I [contacted ! 1 to set/up about 40 

E-Mail addresses wit h a d dm4m name of GREENBERGTRAURLGLAW. COM. 

I 1 explained to □□ tmat he was a summer clerk with GT and 

that GT was setting up n ew web pa ges and needed new >E-Mail 
accounts. Additionally, I \ requested Goo gle move the acco unt 

to premium support for the amount of $25,000. 1 I provided 

with a credit card number for the purchase. The credit card_ 

payment did not go through. At that time, Google contacted I 1 

I I then found the website WWW.GREENBERGTRAURIGLAW.COM. 

and noticed that it was a lmost i dentica^^^^lP^^^q^^nate 
website, GTLAW.COM. When I I utilized the search function of 

GREENBERGTRAURIGLAW.COM to locate GT lawyers, he saw that their 
contact E-Mail addresses had changed to the GREENBERGTRAURIGLAW.COM 
domain. 


_ advised that GT neve r had a summer intern or 

employee named | \ I I did a Google sear ch and Inn a 

a posting on a Korean discussion board from user name 1 _1_ 

requesting help with setting up websites. On June 27, 2008, | 
located a Google Apps discussion posting from MORGERAPGMAIL^COM. 
The poster stated that his/her domain's account 
(GREENBERGTRAURIGLAW.COM) was disabled, and that he/she was the 
administrator. 


1 


, 2008, 



Investigation on 09/24/2008 at New York, New York 


File# 288A-NY-300570 
. SA 

by SA _ 


Date dictated 
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On or about June 27, 2008, I 
from Chicago who does computer forensic work for GT 
GREENBERGTRAURIGLAW.COM shut down. 


a GT shareholder 
, had the 
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FEDERAL BUREAU "OF INVESTIGATION 


Date of transcription 09/22/2008 


I 3 WACHTELL, 

LIPTON, ROSEN & KATZ ("WLRK") law firm, 51 We st 52nd Street, New 
York, New York, 10019-6150, telephone number £ 
inte rviewed at his place of employment. 
were | 


_] was 

Also present from WLRK 


I 


__ __ l Als o present 

from the Federal Bureau of Investigation was I l Computer 

Scientists_After being advised of the identity of the interviewing 

Agents, |_| and the other WLRK employees provided the following 

information: 

On or about June 28, 2008, an anonymous user made changes 
to the WIKIPEDIA.COM entry for WLRK. The same user IP address also 
made changes to the WIKIPEDIA.COM entries for SULLIVAN AND 
CROMWELL, LLP ("S&C"), and GREENBERG TRAURIG, LLP. The most 
notable changes were the changing of the hyperlinks to the law 
firms' websites. The links were changed to reflect incorrect 
domains. 


___ . , | last name 

unknown, a representative of HOSTLYON.COM. contacted [ 


[ 


] stated that on June 30, 2008, 


] 


[_ I at WLR K. to pay for the 

registration of t he WLRK LAW.COM domain. | 1 passed the 

information on to I I who found this strange because WLRK hosts 


their domain internally. WLRK' 
WLRKLAW.COM. According to 


s domain is WLRK.COM and not 
], the person who tried to register 


WLRKLAW.COM had a F lorida IP address, and gave the E-Mail address 


information. 


] with telephone number 


]as contact 


On July 01, 2008, [ 


_ contacted WLRK manage ment an d 

made them aware that someone phished the WLRK website. I I also 

discovered that G0DADDY.COM was hosting WLRKLAW.COM. The 
WLRKLAW.COM website was identical to the legitimate WLRK website. 
However, the WLRKLAW.COM website's "lawyer search" function didn't 
work correctly. It was discovered that a JOTFORM.COM form was used 
as the code for the WLRKLAW.COM search function. 


Investigation on 09/09/2008 at 

New York, New York 

File # 28( 

iA-NY-300570 

Date dictated 

SA 
by SA 
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WLRK next programmed code into their website that popped 
up an error message when users were linked to WLRK.COM from 
WLRKLAW.COM. The purpose of the error message was to inform users 
that they were directed to WLRK.COM from WLRKLAW.COM, and that 
WLRKLAW.COM was in no way affiliated with WLRK. 

I I filed a copyright claim with GODADDY.COM alleging 
that the WLRKLAW.COM copied the WLRK.COM website. GODADDY.COM 
responded by suspending the WLRKLAW.COM domain until the copyright 
claim had been settled. 

On July 02, 2008, I I entered the E-M ail add ress 

MORGERAE@GMAIL.COM into a GOOGLE.COM sea rch bar. I I located two 

postings on Internet newsgroups from the | [ COM E-Mail 

address. The postings were seeking assistance in setti ng up 
enterpri se E-Mail systems. One posting listed the name I I 
| as the contact person. 

On July 03, 2008, NETWORK SOLUTIONS notified I I that 

someone had filed a copyright .claim against WLRK alleging that the 
WLRK.COM website had copied the WLRKLAW.COM website. 

I received an E -Mail to his personal E-Mail address 
from someon e purporting to be I 

I I from E-Mail address ARWOLF@WLRKLAW.COM. The E-Mail 

acknowledged the error message WLRK coded into the WLRK.COM 
website. Additionally, the E-Mail stated that the person filed a 
copyright complaint with NETWORK SOLUTIONS, alleging that WLRK 
copied the WLRK LAW.COM w ebsite. The E-Mail also adv ised I I that 
the person knew I 1 IP address, and referred to | 1 as a 

"fag". 

I I purchased about 150 variations of the WLRK domain 

from NETWORK SOLUTIONS, which cost WLRK about $18,000. On July 09, 
2008, r I attempted to purchase WLRKLAW.COM from G0DADDY.COM, but 
GODADDY.COM would not release the WLRKLAW.COM domain because the 
domain was still under investigation. The "whois" information for 
WLRKLAW.COM on GODADDY.COM listed WLRK as the owner of the 
WLRKLAW.COM domain. Because WLRK was not affiliated with 
WLRKLAW.COM, | | wanted GODADDY.COM to remove WLRK's name and 

contact information from t he "whois". GODADDY.COM wanted many 
forms of proof that | | was acting on WLRK's behalf before 

changing the "whois" information. GODADDY.COM finally suspended 
the "whois" information on July 18, 2008. 
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O n July 18, 2008, f 
E-Mail froml 


I WLRK Partner, received an 
I Partner at S&C. The E-Mail was in 


] received from someone 


ultimately reaching[ 


At this 


response to an E -Mail that I 
purporting to be| 

I E- Mail, 

point, | I realized that although the WLRKLAW.COM domain had been 

suspended, there was still a problem with GOOGLE APS and the E-Mail 
handling. 


became su spiciou s a nd forw arded 

and 


On August 6, 2008, C 


D contacted 


I I at S&C, and notified him tnat s&c mignt oe a 

victim of the same attacks that WLRK was a victim of. 


WLRK does not know who might be behind the attacks or 
what might be a possible motive. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 11/13/2008 


[ 


] 


FIDELITY 

1601 Sawgra ss Corporate Pa rkway. 

J was 


NATIONAL INFORMATION SERVICES,__ 

Suite 130, Sunrise, Florida, phone number [ 

interviewed telephonically. After being advised of the identity of 
the interviewing Agent and the purpose of the interview, 
provided the following information: 


Card Number 4793 4702 2372 2602 is a prepaid gift card 
("GC") that was purchased from the Town Center At Boca Raton mall, 
Boca Raton, Florida, on June 3, 2008, at 15:18 P.M. Eastern 
Standard Time ("EST"). The GC had an original value of $100.00. 

The GC was purchased with a VISA-logo debit card, number I I 

_l issuing bank Sun Trust Bank. On June 21, 2008, at 1:30 

P.M. EST, the GC was used to make a GoDaddy.com purchase. On June 
27, 2008, the GC was used to make another GoDaddy.com purchase in 
the amount of $29.00. 
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investigation on 11/13/2008 at New York, New York 

File # 2 88A**NY — 3 0 057 0 Date dictated 

by SA 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 


Date: 12/17/2008 


To: Miami 


Attn: 


SSA | 

Squad C-5, | | 
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From: New York 

C-37 

Contact: 


Approved By: 
Drafted By: 


^t/ 


Case ID #: 288A-NY-300570 (Pending) 


Title: UNSUB(S); 

SULLIVAN Sc CROMWELL, LLP; 
WACHTELL, LIPTON, ROSEN, & KATZ; 
GREENBERG TRAURIG, LLC - VICTIMS 
COMPUTER INTRUSION 
OO: NY 


Synopsis: To request Miami conduct an interview of 


who are believed to reside at 
Florida, 33067-3925. 


Enclosure(s) : Enclosed for Miami is: One (1) Analyst's Notebook 
link cha rt depicting in graphical for m results of invest igation. 

I and one 


one (1) PSfete of Florida DMV phot o of 
(1) St^te of Florida DMV photo of 
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Details: Sullivan & Cromwell LLP ("S&C"), Wachtell, Lipton, 

Rosen, & Katz ("WLRK"), Greenberg Traurig, LLC ("GT"), and 
Cravath, Swaine, & Moore LLP ("CSM"), are major law firms in New 
York City. The law firms specialize in Corporate Mergers and 
Acquisitions and are ranked the four most prestigious law firms 
in the United States, according to WWW.VAULT.COM. From June 2008 
through July 2008, the four law firms' hyperlink addresses in 
their respective WWW.WIKIPEDIA.ORG ("WIKI") pages were altered. 
WIKI is a free, online encyclopedia, whose content can be edited 
by anyone accessing the WIKI website. The law firms all have 
WIKI entries. The entries contain various information about the 
law firms, including a hyperlink which directs the user to the 
law firm's website. When clicked, the hyperlinks are supposed to 
redirect the user to the law firms' legitimate websites. The 
altered links were disguised to resemble the legitimate law 
firms' websites, but redirected the user to a spoofed version of 
the law firms' websites. 







To: Miami From: New York 

Re: 288A-NY-300570, '12/17/2008 


The legitimate websites for S&C, WLRK, GT, and CSM are 
WWW.SULLCROM.COM, WWW.WLRK.COM, WWW.GTLAW.COM, and 
WWW.CRAVATH.COM, respectively. The spoofed websites had domain 
names of WWW.SULLCROMLAW.COM, WWW.WLRKLAW.COM, 

WWW.GREENBERGTRAURIGLAW.COM, and WWW.CRAVATHLAW.COM. 

New York's investigation has revealed that the 
person(s) responsible for making the WIKI page changes did so 
from IP addresses owned by Comcast Communications. The spoofed 
websites were registered with WWW.G0DADDY.COM from IP addresses 
also owned by Comcast. Records obtained t hrough subpoenas 
indicate the IP addresses were assigned to | | 

6890 NW 75th Court, Pa rkland. Florida, 33067-3925, telephone 
number I [ 

The spoofed websites were hosted by WWW.GODADDY.COM and 
were purchased with prepaid gift cards that were obtained from 
the Boca Raton Town Center Mall in Boca Raton, Florida. The 
contact E-Mail address provided to WWW.G0DADDY.COM for the 
WWW.SULLCR0MLAW.COM domain was SULLCR0M@GMAIL.C0M, for the 
WWW.WLRKLAW.COM domain, WLRKLAW@GMAIL.COM, for the 
WWW.CRAVATHLAW.COM domain, CRAVATHLAW@GMAIL.COM, and for the 
WWW.GREENBERGTRAURIGLAW.COM domain, TP0SETP0SE@YAH00.C0M. 
SULLCR0M@GMAIL.C0M and CRAVATHLAW@GMAIL.COM were both registered 
from IP addresses that are owned by Comcast and assigned to 
I I SULLCROM@GMAIL.COM was also accessed from an 

IP address owned b y Florida Atlantic University and assigned to 
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On June 25, 2008, GT received a "follow-up" phone call 
from a representative of WWW.G00GLE.COM ("GOOGLE") concerning the 
purchase of a premium support service in the amount of $25,000. 


The 

: GOOGLE 

! representative informed GT that a person 

by the name 


° f J 


contacted GOOGLE to set up about 40 

E-Mail 

b6 

add 

.resses 

witn a domain name o£ WWW.GREENBERGTRAURIGLAW.COM. 

b7C 



1 explained to the GOOGLE representative 

that he was a 



summer clerk with GT, and that GT was setting up new web pages 
and needed new E-Mail accounts. The GOOGLE representative's 
reason for the "follow-up" call to GT was bec ause there wa s some 
problem with the credit card information that I I 

provided to GOOGLE to pay for the premium support service. GT 
advised writer that GT has never had a summer intern or employee 
named | | . 

GT conducted a GOOGLE search and locate d a posting on a 
Korean discussion board from user name I I requesting help b6 

with setting up websites. GT also located a GOOGLE Apps b7c 

discussion posting from a user with E-Mail address 


2 










To: Miami From: New York 

Re: 288A-NY-300570, 12/17/2008 


I I The poster stated that his/her domain's 

account, WWW.GREENBERGTRAURIGLAW.COM, was disabled, and that 
he/she was the administrator. The poster was complaining to 
GOOGLE Apps about the account interruption. Records obtained 
through subpoenas indicate that l l is registered 

to the l I Comcast Communications account. 

Florida Atlantic University ("FAU"), 777 Glades Road, 
Boca Raton, Florida, 33431, telephone number (561) 297-1054 , 
advised that |~ I _ 

| | his research 

interests include IP-QoS Network Architectures, Wireless 
Networks, and Information Theory and Coding. 

Public records searches as recent as 12/2008 yielde d 
the following biographical information for 


Name: 

Sex: 

DOB: 

SSN: 

Address: 

Height: 5'10" 

Public records sea rches yielded the follow ing 
biographical information fori t 


Name: 
Sex: 

DOB: 

SSN: 

Address: 


Height: 5'10" 


_ New York requests Miami c onduct interviews of \_ 

| and conduct logical 

investigation to determine the individual responsible for 
captioned acts. 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


3 














To: 
Re: 


Miami From: New York 
288A-NY-300570, 12/17/2008 


LEAD(s): 

Set Lead Is (Action) 

MIAMI 


AT MIAMI. FLORIDA 


New York requests Mi ami_ponduct interviews of 

and conduct logical 


investigation to de termine the individual resnonsihi q for 
captioned acts. Thel 

I , I a-rvw- rniaof i Ann focT 


directed to SA 
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Flr-302 (Rev. 10-6-95) 


- 1 - 

FEDERAL BUREAU bF INVESTIGATION 


51 


Florida, date 



Date of transcription 03 705/2009 
f 


__ 

J Professorl I 


b6 

b7C 


I 


] 


and Lei fert, Y1 
Florida ( FLX 
attorney, [ 


I e-mail addr.ess 
zr was interviewed at the Law Offices of Leifert 
00 South Pine Island Road, Suite 220, Planta tion, 
Also present at the interview was I I 

— ]. After 




being advised of the ide ntity of the interviewing Agents and the 
nature of the interview, | \ provided the following 


information: 


[ 


] has been at FA U for f 


•performs adminis trative duties._[ 


lives with his wife. 


and mostly 


b6 

b7C 


_i aace or airtn i_ 

\ _c.eu^uqj_ar teiepnone numr 

1. da_t.e_o£—birth 

_□_!_ 

_ 1 


[ stated that I Idoes not go out and does not have friends 
over X I I mentioned f —— — - — 


I ~l stated that no one in his family 

has been involved in any civil matters in the past year. 


] 


|uses a laptop prov ided to h im by FAU for work and 
sometimes uses it for personal use. P" 
office but rarely use s it. At homeE"^ 


and both his wife and 


c 


has a desktop in his 
[has a desktop computer 


b6 

b7C 


]have their own personal laptops. 


home is equipped with wireless internet and he believes 
the Wire less router has encryption setup on it but is not sure. 

I ~l acknowledged that his Internet Service Provider (ISP) is 

COMCAST. | T stated his technical expertise when it comes to 

computers and the internet is minimal. I ~1 stated his 

knowledge is more in "theory" than it is "hands on". FAU also 
provides I ~l with an APPLE IPHONE 3G, cellular phone, which 

uses for both work and personal business. His wife also owns an 
APPLE IPHONE .1 I occasiona lly us es the internet feature on 

his IPHONE. | | stated that I I does not have a cellular 

phone. 





b6 

b7C 


investigation on 03/05/2009 at Plantation, Florida 


File# 288A-NY-300570 Date dictated 03/05/2009 

SAl 

by SA 


This document contains neither recommendations nor conclusions of the FBI. 
it and its contents are not to be distributed outside your agency. 


It is the property of the FBI and is loaned to your agency; 









FD-302a (Rev. 10-6-95) 


2 8 8A-NY-3 00570 


Continuation of FD-302 of 


, On 03 /05/2009 , Page 


|_| has a perso nal websi te that was created for him 

by FAU and is hosted by FAU. I 1 stated he does not have any 

other websites or does he have the knowledge to create a website . 
Writer askedI I about personal e-mail accounts but | 1 

advised I I not to answer any questions about personal e-mail 

accounts. 

I I uses an application on his laptop th at all ows him 

to see I comput er screen and monitor the websites | |visits . 

I I stated | is aware of the monitoring software. | | 

explained that ] uses the int ernet mos tly for homework and 

sometimes to purchase clothing . I ~~| wou ld be present when |~ | 

was shopping online. ~f indicated that I I receives an 

allowance of a minimal amount and occ asiona lly receives a gift card 
for the mall. I ~1 estimated that I I receives approxim ately 

three (3) gift cards of twenty-five dollars a year.1 I 

mentioned _ does not have a credit card. I ~l banks at BANK 

OF AMERICA and has a business credit card from FAU. I ~l did 

not recall what bank FAU uses. 


has not traveled for work muc h in the past couple 
of years due to budget issues at FAU. I ~l occasion ally travels 

to ORLANDO and the BAHAMAS with his family. I I last visit 

to the BAHAMAS was in June of 2008. I I admitted he did travel 

to Naples, Florida in August of 2008. D espite th is bein g a work 
trip, I ~1 took his fmaily with him. I 1 advised ! I 

not to answer any other questions regarding the Naples trip. 

I ~l has used WIKIPEDIA, a f ree onlin e encyclopedia 

that users can freely edit, on occasion. I ~1 has never visited 

or heard of S ULLCROM.C OM, WRLK.COM, GREENBERGTRAURIG.COM or 
CRAVATH.COM. | I stated he has never checked the email 

SULLCROMOGMAIL.COM. 

,_, SA | I for consent to search his laptop. 

_ adv ised I I not to give the FBI consent to search the 

laptop. SA | | reminded _ that his laptop was owned by 

FAU and tha t the FBI might ask FA U for consent to search the 
laptop. SA I ~l not to alter or destroy the 

contents of the laptop. 

Wr iter s tated to I I that the FBI is interested in 

interviewing I ~| stated th at he wou ld like to speak with 

I | before the FBI interviewed him. I ~l indica ted he would 

contact writer about a possible interview with I I 

























UNCLASSIFIED 


j (Rev. 05-01-2008) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Dates 03/10/2009 


To: New York 


Attn: Squad C-37 

SAl- 


From: Miami 

C-5 

Contact: 

Approved By: _ 

Drafted By: I 


if 


Case ID #: 288A-NY-300570 (Pending )-'/(J 

Title: UNSUB(s); 

SULLIVAN & CROMWELL, LLP; 

WACHTELL, LIPTON, ROSEN, Sc KATZ; 

GREENBERG TAURIG, LLC - VICTIMS 
COMPUTER INTRUSIONS 
00: NY 

Synopsis: To forward results of investigation pertaining to 

captioned matter and to cover lead. 

Reference: 288A-NY-300570 Serial 16 


Enclosure(s) : For New York are the following: 

1. Interview with I ' I (FD-302) . 

2. 1A envelope containing written notes of the 


2. 1A envelope containing written notes of the |_[interview. 

Details: On 03/02/2009, Spe cial Agent (SA) f 1 was 

telephonically co ntacted b y | Writer scheduled 

an interview with | | for 03/05/2009. On 03/03/2009, writer 

was contacted by | [attorney, who stated he 

would like the FBI to speak witn I l at his office. On 

03/05/2009, SA | | and S Al I met with 

| and his attorney _ 

As requested in the referenced lead, I I 

was questioned about his involvement in the spoofing of the 
websites WWW.SULLCROM.COM, WWW.WLRK.COM, WWW.GTLAW.COM and 
WWW.CRAVATH.COM. Details are included in the enclosed FD-302. 
Morgera was notified that the FBI was interested in interviewing 



UNCLASSIFIED 



[Oisd'roo\. <f 1 







UNCLASSIFIED 


To: New York From: Miami 

Re: 288A-NY-300570, 03/10/2009 


his son, I 
interviewed 

nterviewed him. Q_ 

possible meeting with |_ 


] explained that he had not 


contacted writer via e-mail and stated[ 


1 and would like to do so before the FBI 
~1 stated he would contact writer about a 
On 03/10/2009, I.I 


the position to give an interview. 


was not m 


Based on the above, Miami considers this lead covered. 


UNCLASSIFIED 





UNCLASSIFIED 


To: New York From: Miami 

Re: 288A-NY-3 0057 0, 03/10/2009 


LEAD(s): 

Set Lead 1: (Info) 

NEW YORK 

AT NEW YORK, NEW YORK 
Read and clear. 


♦♦ 


UNCLASSIFIED 












(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/10/2009 

To : New York 

From: New York 

Squad CY-3 

Contact: 


Approved By: [ 

Drafted By: | fc >b ^ 

Case ID #: 196E-NY-296425 (Pending) 

288A-NY-300570 (Pending) 

2 8 8A-NY-3 00870 (Pending) 


Title: TRANSFER CASES 

Synopsis: To request the transfer of above cases. 

Details: Due to the transfer of the writer to Squad CY-3 it is 

requested the above captioned cases be transferred to squad CY-3. 


] 212-384-3614 


J5 


b6 

b7C 


♦♦ 













(Rev. 05-01-2008) 


UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/28/2009 

To: New York Attn: SST CY-2 

SST CY-3 


b6 

b7C 


Drafted By: | | :pb 

Case ID #: 288A-NY-300570 (Pending) 

Title: UNSUB(s) 

SULLIVAN & CROMWELL LLP; 

WACHTELL, LIPTON, ROSEN Sc KATZ; 

GREENBERG TRAURIG, LLC - VICTIMS 
CIP; 

OO :NY 

Synopsis: Request that case file be transferred from Squad CY-2 

to Squad CY-3. 

Details: The purpose of this EC is to request the captioned case 

file be administratively transferred from Squad CY-2 to Squad CY- 

3. There has been a realignment of the New York Division Cyber 

Crime Program and the creation of new squads. SA I l is the b6 

case agent of the captioned case and has been designated to squad b7c 

CY-3. Therefore, it is requested that this case be transferred to 

CY-3 in order for it to be successfully completed. 

CC: 1 - 288A-NY-300570 


From: New York 

Squad CY-3 

Contact: SA 


Approved By: [ 


♦♦ 


UNCLASSIFIED 


StAt-LCTO^ + rC\, ; 1<(L 









(01/26/1998) 


FEDERAL BUREAU OF INVESTIGATION 


Precedences ROUTINE Date: 04/23/2010 

To : New York 


From: New York 

Squad CY-3 
Contact s SA 


Approved By: I I 

Drafted By: I h ob 

Case ID #: 288A-NY-3 00570 (Pending) 


Title: UNSUB(s) 

SULLIVAN & CROMWELL LLP; 
WACHTELL, LIPTON, ROSEN & KATZ; 
GREENBERG TRAURIG, LLC - VICTIMS 
CIP; 

00 :NY 


Synopsis: Close case administratively. 

Details: Writer recommends case is closed administratively due 

to the lack of venue and prosecutorial merit. 







